Verdant Grants
A grant-application portal. The one page nobody looks at twice is a cookie policy with a locale in its URL. A compliance reviewer opens whatever legal page an applicant was reading, and their case file holds a reference you need.
- Attempts
- 5
- Solves
- 2
- Published
- 20 Sep 2026
The engagement
Verdant Grants is a funding portal. Members of the public apply for grants, attach the documents that prove who they are (identity papers, bank letters, references), and wait for a panel.
You are testing it. The application flow, the uploads and the sign-in are hardened and heavily tested; other people have been over them. What has not been looked at is the part of the site that exists for the lawyers: the terms, the privacy notice, the cookie policy. Every one of them has a locale in its URL and every one of them is a page whose entire job is to display fixed text.
Compliance reviewers at Verdant do read them. When an applicant has a legal page open, it is filed with the compliance team, and a reviewer opens exactly the URL the applicant was looking at. Reviewers also work escalated cases, and their case file carries an escalation reference for the current review window.
You have no account. Applicants do not get one, and the staff sign-in is not yours to pass.
Goal
Exploit the XSS vulnerability to execute JavaScript in the compliance reviewer's browser, retrieve the escalation reference from /reviewer/casefile.php, and exfiltrate it to /capture.php.
The case file is inaccessible to regular users, and the portal does not expose any endpoint that directly reveals its contents. The escalation reference will appear in your banner once successfully captured.
What counts
Making something happen in a reviewer's browser is not the finding. Reading their case file with it is. A dialog box gets dismissed and nothing else.